CI: pin builds to the desktop runner

The RN/NDK build exhausted the 8GB VPS (whole docker stack went down
2026-08-08); marcusDesktop (32 threads) now handles these, and jobs
queue while it is offline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,86 @@
+name: Build & Release APK
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    # RN/NDK builds need ~6GB and once took down the 8GB VPS — desktop runner only.
+    # Jobs queue while the desktop is offline.
+    runs-on: desktop
+    container:
+      image: eclipse-temurin:21-jdk
+    steps:
+      # actions/checkout needs node, which this container lacks — clone directly
+      - name: Checkout
+        run: |
+          apt-get update -qq && apt-get install -y -qq git unzip curl xz-utils >/dev/null
+          git init -q .
+          git fetch -q --depth 1 "https://git.rehbock.xyz/${{ github.repository }}.git" "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
+
+      - name: Install Node 22
+        run: |
+          curl -sLo /tmp/node.tar.xz https://nodejs.org/dist/v22.14.0/node-v22.14.0-linux-x64.tar.xz
+          mkdir -p /opt/node && tar xJf /tmp/node.tar.xz -C /opt/node --strip-components=1
+          echo "/opt/node/bin" >> "$GITHUB_PATH"
+          /opt/node/bin/node --version
+
+      - name: npm ci
+        run: npm ci --no-audit --no-fund
+
+      - name: Install Android SDK + NDK
+        run: |
+          mkdir -p "$HOME/android-sdk/cmdline-tools"
+          curl -sLo /tmp/ct.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
+          unzip -q /tmp/ct.zip -d /tmp
+          mv /tmp/cmdline-tools "$HOME/android-sdk/cmdline-tools/latest"
+          SDKMAN="$HOME/android-sdk/cmdline-tools/latest/bin/sdkmanager"
+          yes | "$SDKMAN" --sdk_root="$HOME/android-sdk" --licenses >/dev/null 2>&1 || true
+          "$SDKMAN" --sdk_root="$HOME/android-sdk" \
+            "platform-tools" "platforms;android-36" "build-tools;36.0.0" \
+            "ndk;27.1.12297006" "cmake;3.22.1" >/dev/null
+
+      - name: Decode signing keystore
+        env:
+          KEYSTORE_B64: ${{ secrets.KEYSTORE_B64 }}
+        run: echo "$KEYSTORE_B64" | base64 -d > /tmp/release.jks
+
+      - name: Prebuild android project
+        env:
+          VERSION_CODE: ${{ github.run_number }}
+          VERSION_NAME: 1.0.${{ github.run_number }}
+        run: npx expo prebuild --platform android --no-install
+
+      - name: Build signed release APK (arm64)
+        env:
+          HEALTH_KEYSTORE: /tmp/release.jks
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: health
+          VERSION_CODE: ${{ github.run_number }}
+          VERSION_NAME: 1.0.${{ github.run_number }}
+        run: |
+          export ANDROID_HOME="$HOME/android-sdk"
+          echo "sdk.dir=$ANDROID_HOME" > android/local.properties
+          cd android && ./gradlew assembleRelease -PreactNativeArchitectures=arm64-v8a \
+            --no-daemon --console=plain
+
+      - name: Publish Gitea release with APK
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          API="https://git.rehbock.xyz/api/v1/repos/${{ github.repository }}"
+          TAG="v1.0.${{ github.run_number }}"
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          test -f "$APK"
+          curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Automated build of commit ${{ github.sha }}\",\"target_commitish\":\"${{ github.sha }}\"}" \
+            > /tmp/release.json
+          RID=$(grep -o '"id":[0-9]*' /tmp/release.json | head -1 | cut -d: -f2)
+          echo "release id: $RID"
+          curl -sf -X POST "$API/releases/$RID/assets?name=health-app-$TAG-arm64.apk" \
+            -H "Authorization: token $TOKEN" \
+            -F "attachment=@$APK;type=application/vnd.android.package-archive" >/dev/null
+          echo "published $TAG"

README.md

@@ -47,8 +47,16 @@ cd android && ./gradlew assembleRelease
 # → android/app/build/outputs/apk/release/app-release.apk
 ```
 
-Install on GrapheneOS by copying the APK over (or via Obtainium once a
-Gitea release exists).
+Install on GrapheneOS by copying the APK over, or via Obtainium.
+
+## CI (Gitea Actions)
+
+Every push to `main` runs `.gitea/workflows/release.yml`: prebuild →
+signed arm64 APK → Gitea release tagged `v1.0.<run_number>`, APK attached.
+`app.config.js` stamps `VERSION_CODE`/`VERSION_NAME` from the run number so
+each release installs as an upgrade (Obtainium-friendly).
+
+Repo secrets: `KEYSTORE_B64` (base64 of the jks), `KEYSTORE_PASSWORD`.
 
 ## iOS
 

app.config.js

@@ -0,0 +1,10 @@
+/* Wraps app.json so CI can stamp versions: VERSION_NAME → expo.version,
+   VERSION_CODE → android.versionCode (Obtainium needs it to increase). */
+module.exports = ({ config }) => {
+  const versionCode = parseInt(process.env.VERSION_CODE || '', 10);
+  if (process.env.VERSION_NAME) config.version = process.env.VERSION_NAME;
+  if (Number.isFinite(versionCode)) {
+    config.android = { ...config.android, versionCode };
+  }
+  return config;
+};

plugins/with-release-signing.js

@@ -40,6 +40,17 @@ module.exports = function withReleaseSigning(config) {
     if (jdk && !cfg.modResults.some((p) => p.key === 'org.gradle.java.home')) {
       cfg.modResults.push({ type: 'property', key: 'org.gradle.java.home', value: jdk });
     }
+    /* use every core: parallel module builds + build cache */
+    const set = (key, value) => {
+      const hit = cfg.modResults.find((p) => p.key === key);
+      if (hit) hit.value = value;
+      else cfg.modResults.push({ type: 'property', key, value });
+    };
+    set('org.gradle.parallel', 'true');
+    set('org.gradle.caching', 'true');
+    set('org.gradle.configuration-cache', 'false');
+    set('org.gradle.workers.max', String(os.cpus().length));
+    set('org.gradle.jvmargs', '-Xmx6g -XX:MaxMetaspaceSize=1g');
     return cfg;
   });
   return withAppBuildGradle(config, (cfg) => {